Disabling Diffie-Hellman Key Exchange in IIS

This article applies to:

To control key exchange algorithms and protocols, you can set values in the Windows Registry.

Caution: As always, take due care when editing the Registry. Trustwave recommends that you back up the Registry before making any changes.

The settings provided below are for information only. You should confirm the applicability to your environment.

By default, Diffie-Hellman key exchange is enabled.

To disable Diffie-Hellman key exchange:

Run Regedit
To access Key Exchange algorithm settings, navigate to the following Registry location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms
For Diffie-Hellman, navigate to the subkey Diffie-Hellman
Create, or edit, a DWORD value
- Name: Enabled
- Value Data: 0

To re-enable Diffie-Hellman key exchange, set the Hexadecimal value data of "Enabled" to 0xffffffff (or simply delete the "Enabled" value)

By default, Diffie-Hellman key exchange is enabled. (Other default configuration settings are such that this algorithm may never be selected.)

The procedures to disable the algorithm are slightly more complex due to differences in the Registry structure.

To disable Diffie-Hellman key exchange:

Run Regedit
To access Key Exchange algorithm settings, navigate to the following Registry location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SChannel\KeyExchangeAlgorithms
Create a new sub key named Diffie-Hellman
Within the key Diffie-Hellman, create a DWORD value
- Name: Enabled
- Value Data: 0

To re-enable Diffie-Hellman key exchange, set the Hexadecimal value data of "Enabled" to 0xffffffff (or simply delete the "Enabled" value)

When you disable any algorithm, you disallow all cipher suites that use that algorithm.
See also Microsoft Knowledge Base article 245030: How to Restrict the Use of Certain Cryptographic Algorithms and Protocols in Schannel.dll